Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects path traversal injection attempts within the 'url' parameter targeting GitHub repository URLs. The rule inspects web request query parameters for various path traversal techniques, including standard dots, URL-encoded patterns, double-encoding, null-byte injections, and common file path indicators like '/etc/passwd' or '/proc/self/environ'.
This rule detects the execution of 'gs-netcat' or 'gsocket' utilities, as well as specific configurations of 'smbd' that suggest potential use of network tools for remote command and control or unauthorized access. GSocket allows for the creation of secure reverse shells and peer-to-peer communication channels, which are often used by adversaries to bypass firewall restrictions.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Identifies AstarionRAT establishing HTTP POST connections to transmit the compressed archive containing the stolen browser and keylogger data. This rule correlates network HTTP POST requests with the creation of zip files by the same process, indicating potential data exfiltration.
Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.
Detects sign-ins from additional IP ranges associated with Kali365 infrastructure and proxies, which could indicate token replay attacks or other unauthorized access attempts.
Detects AstarionRAT's infostealing capability rapidly accessing multiple Chromium and Firefox SQLite databases to steal credentials and cookies.
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
Detects instances where the SSH daemon (sshd) or its related components, such as PAM libraries, create or write to files located in /tmp/ or hidden files in /var/ directories, which may indicate unauthorized configuration changes, credential manipulation, or staging of malicious files.
Page 935 of 1168